CVE-2017-16642

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.

• CWE-125

• http://php.net/ChangeLog-5.phpIssue Tracking, Release Notes, Vendor Advisory
• http://php.net/ChangeLog-7.phpIssue Tracking, Release Notes, Vendor Advisory
• http://www.securityfocus.com/bid/101745Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1296Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=75055Issue Tracking, Vendor Advisory
• https://github.com/derickr/timelib/commit/aa9156006e88565e1f1a5f7cc088b18322d57536Issue Tracking, Patch, Third Party Advisory
• https://github.com/php/php-src/commit/5c0455bf2c8cd3c25401407f158e820aa3b239e1Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20181123-0001/Third Party Advisory
• https://usn.ubuntu.com/3566-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4080Third Party Advisory
• https://www.debian.org/security/2018/dsa-4081Third Party Advisory
• https://www.exploit-db.com/exploits/43133/Exploit, Issue Tracking, Third Party Advisory, VDB Entry
• http://php.net/ChangeLog-5.phpIssue Tracking, Release Notes, Vendor Advisory
• http://php.net/ChangeLog-7.phpIssue Tracking, Release Notes, Vendor Advisory
• http://www.securityfocus.com/bid/101745Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1296Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=75055Issue Tracking, Vendor Advisory
• https://github.com/derickr/timelib/commit/aa9156006e88565e1f1a5f7cc088b18322d57536Issue Tracking, Patch, Third Party Advisory
• https://github.com/php/php-src/commit/5c0455bf2c8cd3c25401407f158e820aa3b239e1Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20181123-0001/Third Party Advisory
• https://usn.ubuntu.com/3566-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4080Third Party Advisory
• https://www.debian.org/security/2018/dsa-4081Third Party Advisory
• https://www.exploit-db.com/exploits/43133/Exploit, Issue Tracking, Third Party Advisory, VDB Entry

Published

Nov 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16636In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located…
• CVE-2017-16637In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11…
• CVE-2017-16638The Gentoo net-misc/vde package before version 2.3.2-r4 may …
• CVE-2017-16639Tor Browser on Windows before 8.0 allows remote attackers to…
• CVE-2017-1664IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weak…
• CVE-2017-16641lib/rrd.php in Cacti 1.1.27 allows remote authenticated admi…
• CVE-2017-16643The parse_hid_report_descriptor function in drivers/input/ta…
• CVE-2017-16644The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-co…
• CVE-2017-16645The ims_pcu_get_cdc_union_desc function in drivers/input/mis…
• CVE-2017-16646drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux ker…
• CVE-2017-16647drivers/net/usb/asix_devices.c in the Linux kernel through 4…
• CVE-2017-16648The dvb_frontend_free function in drivers/media/dvb-core/dvb…